https://security.netapp.com/advisory/ntap-20210312-0005/

DSA-4856

According to the versions of the php packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21     and 7.4.x below 7.4.9, while processing PHAR files     using phar extension, phar_parse_zipfile could be     tricked into accessing freed memory, which could lead     to a crash or information disclosure.(CVE-2020-7068)

  - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23     and 7.4.x below 7.4.11, when PHP is processing incoming     HTTP cookie values, the cookie names are url-decoded.
    This may lead to cookies with prefixes like __Host     confused with cookies that decode to such prefix, thus     leading to an attacker being able to forge cookie which     is supposed to be secure. See also CVE-2020-8184 for     more information.(CVE-2020-7070)

  - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23     and 7.4.x below 7.4.11, when AES-CCM mode is used with     openssl_encrypt() function with 12 bytes IV, only first     7 bytes of the IV is actually used. This can lead to     both decreased security and incorrect encryption     data.(CVE-2020-7069)

  - In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14     and 8.0.0, when validating URL with functions like     filter_var($url, FILTER_VALIDATE_URL), PHP will accept     an URL with invalid password as valid URL. This may     lead to functions that rely on URL being valid to     mis-parse the URL and produce wrong data as components     of the URL.(CVE-2020-7071)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in denial of service, information disclosure, cookie forgery or incorrect encryption.

According to the version of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - FILTER_VALIDATE_URL accepts URLs with invalid     userinfo(CVE-2020-7071)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issue :

  - CVE-2020-7071: Fixed an insufficient filter in     parse_url() that accepted URLs with invalid userinfo     (bsc#1180706).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for php7 fixes the following issue :

  - CVE-2020-7071: Fixed an insufficient filter in     parse_url() that accepted URLs with invalid userinfo     (bsc#1180706).

This update was imported from the SUSE:SLE-15:Update update project.

According to its self-reported version number, the version of PHP installed on the remote host is 7.3.x prior to 7.3.26, 7.4.x prior to 7.4.14, or 8.x prior to 8.0.1. It is, therefore, affected by an input validation error due to insufficient validation of a URL, as specified by the changelogs of the respective fixed releases. An unauthenticated, remote attacker can exploit this, by including an '@' character, in order to bypass the URL filter.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-ca0e53d310 advisory.

  - In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like     filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may     lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components     of the URL. (CVE-2020-7071)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for php72 fixes the following issue :

CVE-2020-7071: Fixed an insufficient filter in parse_url() that accepted URLs with invalid userinfo (bsc#1180706).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issue :

CVE-2020-7071: Fixed an insufficient filter in parse_url() that accepted URLs with invalid userinfo (bsc#1180706).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php74 fixes the following issue :

CVE-2020-7071: Fixed an insufficient filter in parse_url() that accepted URLs with invalid userinfo (bsc#1180706).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-8dac5c39f3 advisory.

  - In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like     filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may     lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components     of the URL. (CVE-2020-7071)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is 7.3.x prior to 7.3.26, 7.4.x prior to 7.4.14, or 8.x prior to 8.0.1.
It is, therefore, affected by an input validation error due to insufficient validation of a URL, as specified by the changelogs of the respective fixed releases. An unauthenticated, remote attacker can exploit this, by including an '@' character, in order to bypass the URL filter.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version

ID	Name	Product	Family	Severity
147033	EulerOS Virtualization for ARM 64 3.0.6.0 : php (EulerOS-SA-2021-1566)	Nessus	Huawei Local Security Checks	medium
146613	Debian DSA-4856-1 : php7.3 - security update	Nessus	Debian Local Security Checks	medium
145742	EulerOS 2.0 SP8 : php (EulerOS-SA-2021-1163)	Nessus	Huawei Local Security Checks	medium
145395	openSUSE Security Update : php7 (openSUSE-2021-106)	Nessus	SuSE Local Security Checks	medium
145336	openSUSE Security Update : php7 (openSUSE-2021-101)	Nessus	SuSE Local Security Checks	medium
112679	PHP 7.3.x < 7.3.26 Input Validation Error	Web Application Scanning	Component Vulnerability	medium
112678	PHP 7.4.x < 7.4.14 Input Validation Error	Web Application Scanning	Component Vulnerability	medium
112677	PHP 8.x < 8.0.1 Input Validation Error	Web Application Scanning	Component Vulnerability	medium
145141	Fedora 32 : php (2021-ca0e53d310)	Nessus	Fedora Local Security Checks	medium
145031	SUSE SLES12 Security Update : php72 (SUSE-SU-2021:0125-1)	Nessus	SuSE Local Security Checks	medium
145030	SUSE SLED15 / SLES15 Security Update : php7 (SUSE-SU-2021:0124-1)	Nessus	SuSE Local Security Checks	medium
145019	SUSE SLES12 Security Update : php74 (SUSE-SU-2021:0126-1)	Nessus	SuSE Local Security Checks	medium
144955	Fedora 33 : php (2021-8dac5c39f3)	Nessus	Fedora Local Security Checks	medium
144947	PHP 7.3.x < 7.3.26 / 7.4.x < 7.4.14 / 8.x < 8.0.1 Input Validation Error	Nessus	CGI abuses	medium

CVE-2020-7071

MEDIUM

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Configuration 3

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium